Subject: RE: [mobile-ip] fastv6 and CoAs

From: "Hesham Soliman (EAB)" <[email-masked]>
Date: Tue, 24 Sep 2002 21:03:18 +0200

> 
  > I don't think we are breaking it any more than
  > allowing HoA and reverse tunneling
  > from FA in MIPv4. Are we ?

=> Do networks deploying MIPv4 run ingress filtering
if there was no reverse tunnelling from the FA?

I don't think MIPv4 is a good example :)

  > I think it is harder to spoof an arbitrary combination
  > of off-link prefix and iid.
  > Here is what a malicious node needs to do I think.
  > 
  > - spoof the off-link prefix. How ? by monitoring the traffic ?
  >    How is prefix length determined ? 

=> Who cares? It's spoofing the whole thing. Anyway,
the IPv6 prefix length is 64.

The off-link prefix
  >    is never advertised on the new router's link. If the attacker
  >    moved from the link where the off-link prefix is valid,
  >    then he would know the off-link prefix.

=> He doesn't need to, see above.

  > - spoof the MAC address. How ? Through ND.

=> Monitoring traffic. No need for ND.

  > - keep looking for the "window" to open. That is, guess when
  >    the new router would allow traffic with previous CoA.
  > - send packets with the spoofed address
  > 
  > This is hard work with questionable incentives, especially if
  > the tunnel lifetime is kept short. 

=> As I said earlier, in a real situation there is probably
more than one MN doing a handover, so there is more
than one of those addresses.

Hesham

---

From: Rajeev Koodli <[email-masked]>
Date: Tue, 24 Sep 2002 12:50:28 -0700

> if there was no reverse tunnelling from the FA?

Whether they do or not, reverse tunneling came about
because of ingress filtering, at least according to RFC 2344
that specifies reverse tunneling.
So, there is precedence in the standards process.

> I don't think MIPv4 is a good example :)

I don't agree :-)

> than one of those addresses.

But to use more than one address, you need to keep spoofing
all those addresses and use them when their respective windows
are open. So, I still think the incentives are questionable.
However, we should include these issues under Security Considerations.

-Rajeev

---

From: "James Kempf" <[email-masked]>
Date: Tue, 24 Sep 2002 21:04:35 -0700

> However, we should include these issues under Security Considerations.

I think the issues need some more clear definition. If a handover is
authenticated between the access routers, I don't see how any other address from
the source subnet could be spoofed on the new access router. An address send via
the authenticated HI/HACK that was source routed could be spoofed, of course,
but that is exactly the same for addresses that are on the link as well. The
access router performs ingress filtering using the address as a /128 instead of
the prefix as a /64.

            jak